66 static void DetectDnsQueryRegisterTests(
void);
68 static int g_dns_query_buffer_id = 0;
90 if (rs_dns_tx_get_query_name(cbdata->
txv, cbdata->
local_id, &data, &data_len) == 0) {
100 void *alstate,
void *txv, uint64_t tx_id)
102 uint32_t local_id = 0;
112 DnsQueryGetData(det_ctx, transforms, f, &cbdata, engine->
sm_list);
113 if (buffer == NULL || buffer->
inspect == NULL)
155 const int list_id = ctx->
list_id;
157 uint32_t local_id = 0;
177 static void PrefilterMpmDnsQueryFree(
void *ptr)
194 mpm_reg->
app_v2.alproto, mpm_reg->
app_v2.tx_min_progress,
195 pectx, PrefilterMpmDnsQueryFree, mpm_reg->
pname);
215 PrefilterMpmDnsQueryRegister, NULL,
220 DetectEngineInspectDnsQuery, NULL);
223 "dns request query");
267 static int DetectDnsQueryTest01(
void)
270 uint8_t buf[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
271 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
272 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
273 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
274 0x00, 0x10, 0x00, 0x01, };
276 void *dns_state = NULL;
284 memset(&f, 0,
sizeof(
Flow));
287 "192.168.1.5",
"192.168.1.1",
292 f.
proto = IPPROTO_UDP;
306 "(msg:\"Test dns_query option\"; "
307 "dns_query; content:\"google\"; nocase; sid:1;)");
314 STREAM_TOSERVER, buf,
sizeof(buf));
316 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
327 printf(
"sig 1 didn't alert, but it should have: ");
346 static int DetectDnsQueryTest02(
void)
349 uint8_t buf1[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
350 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
351 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
352 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
353 0x00, 0x01, 0x00, 0x01, };
355 uint8_t buf2[] = { 0x10, 0x32,
359 0x00, 0x00, 0x00, 0x00,
361 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
362 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
363 0x00, 0x01, 0x00, 0x01,
366 0x00, 0x01, 0x00, 0x01,
367 0x00, 0x01, 0x40, 0xef,
369 0x01, 0x02, 0x03, 0x04 };
372 uint8_t buf3[] = { 0x11, 0x33, 0x01, 0x00, 0x00, 0x01,
373 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
374 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
375 0x65, 0x03, 0x6E, 0x65, 0x74, 0x00,
376 0x00, 0x10, 0x00, 0x01, };
378 void *dns_state = NULL;
379 Packet *p1 = NULL, *p2 = NULL, *p3 = NULL;
386 memset(&f, 0,
sizeof(
Flow));
389 "192.168.1.5",
"192.168.1.1",
392 "192.168.1.5",
"192.168.1.1",
395 "192.168.1.5",
"192.168.1.1",
400 f.
proto = IPPROTO_UDP;
425 "(msg:\"Test dns_query option\"; "
426 "dns_query; content:\"google.com\"; nocase; sid:1;)");
429 "(msg:\"Test dns_query option\"; "
430 "dns_query; content:\"google.net\"; nocase; sid:2;)");
437 STREAM_TOSERVER, buf1,
sizeof(buf1));
439 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
450 printf(
"(p1) sig 1 didn't alert, but it should have: ");
454 printf(
"(p1) sig 2 did alert, but it should not have: ");
461 printf(
"toserver client 1 returned %" PRId32
", expected 0: ", r);
469 printf(
"(p2) sig 1 alerted, but it should not have: ");
473 printf(
"(p2) sig 2 alerted, but it should not have: ");
480 printf(
"toserver chunk 3 returned %" PRId32
", expected 0: ", r);
488 printf(
"(p3) sig 1 alerted, but it should not have: ");
492 printf(
"(p3) sig 2 didn't alert, but it should have: ");
513 static int DetectDnsQueryTest03(
void)
516 uint8_t buf[] = { 0x00, 28,
517 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
518 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
519 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
520 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
521 0x00, 0x10, 0x00, 0x01, };
523 void *dns_state = NULL;
532 memset(&f, 0,
sizeof(
Flow));
536 "192.168.1.5",
"192.168.1.1",
542 f.
proto = IPPROTO_TCP;
558 "(msg:\"Test dns_query option\"; "
559 "dns_query; content:\"google\"; nocase; sid:1;)");
566 STREAM_TOSERVER, buf,
sizeof(buf));
568 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
579 printf(
"sig 1 didn't alert, but it should have: ");
600 static int DetectDnsQueryTest04(
void)
603 uint8_t buf[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
604 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
605 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
606 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
607 0x00, 0x10, 0x00, 0x01, };
609 void *dns_state = NULL;
617 memset(&f, 0,
sizeof(
Flow));
620 "192.168.1.5",
"192.168.1.1",
625 f.
proto = IPPROTO_UDP;
639 "(msg:\"Test dns_query option\"; "
640 "dns_query; content:\"google\"; nocase; "
641 "pcre:\"/google\\.com$/i\"; sid:1;)");
644 "(msg:\"Test dns_query option\"; "
645 "dns_query; content:\"google\"; nocase; "
646 "pcre:\"/^\\.[a-z]{2,3}$/iR\"; sid:2;)");
653 STREAM_TOSERVER, buf,
sizeof(buf));
655 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
666 printf(
"sig 1 didn't alert, but it should have: ");
670 printf(
"sig 2 didn't alert, but it should have: ");
690 static int DetectDnsQueryTest05(
void)
693 uint8_t buf1[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
694 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
695 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
696 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
697 0x00, 0x01, 0x00, 0x01, };
699 uint8_t buf2[] = { 0x10, 0x32,
703 0x00, 0x00, 0x00, 0x00,
705 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
706 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
707 0x00, 0x01, 0x00, 0x01,
710 0x00, 0x01, 0x00, 0x01,
711 0x00, 0x01, 0x40, 0xef,
713 0x01, 0x02, 0x03, 0x04 };
716 uint8_t buf3[] = { 0x11, 0x33, 0x01, 0x00, 0x00, 0x01,
717 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
718 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
719 0x65, 0x03, 0x6E, 0x65, 0x74, 0x00,
720 0x00, 0x10, 0x00, 0x01, };
722 void *dns_state = NULL;
723 Packet *p1 = NULL, *p2 = NULL, *p3 = NULL;
730 memset(&f, 0,
sizeof(
Flow));
733 "192.168.1.5",
"192.168.1.1",
736 "192.168.1.5",
"192.168.1.1",
739 "192.168.1.5",
"192.168.1.1",
744 f.
proto = IPPROTO_UDP;
769 "(msg:\"Test dns_query option\"; "
770 "dns_query; content:\"google.com\"; nocase; sid:1;)");
773 "(msg:\"Test dns_query option\"; "
774 "dns_query; content:\"google.net\"; nocase; sid:2;)");
777 "(msg:\"Test Z flag event\"; "
778 "app-layer-event:dns.z_flag_set; sid:3;)");
785 STREAM_TOSERVER, buf1,
sizeof(buf1));
787 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
798 printf(
"(p1) sig 1 didn't alert, but it should have: ");
802 printf(
"(p1) sig 2 did alert, but it should not have: ");
809 printf(
"toserver client 1 returned %" PRId32
", expected 0\n", r);
817 printf(
"(p2) sig 1 alerted, but it should not have: ");
821 printf(
"(p2) sig 2 alerted, but it should not have: ");
825 printf(
"(p2) sig 3 didn't alert, but it should have: ");
832 printf(
"toserver chunk 3 returned %" PRId32
", expected 0: ", r);
840 printf(
"(p3) sig 1 alerted, but it should not have: ");
844 printf(
"(p3) sig 2 didn't alert, but it should have: ");
870 static int DetectDnsQueryIsdataatParseTest(
void)
877 "alert dns any any -> any any ("
878 "dns_query; content:\"one\"; "
879 "isdataat:!4,relative; sid:1;)");
895 static void DetectDnsQueryRegisterTests(
void)
899 UtRegisterTest(
"DetectDnsQueryTest03 -- tcp", DetectDnsQueryTest03);
900 UtRegisterTest(
"DetectDnsQueryTest04 -- pcre", DetectDnsQueryTest04);
902 DetectDnsQueryTest05);
905 DetectDnsQueryIsdataatParseTest);